CVE-2025-3777

What it actually does

Hugging Face Transformers improperly validates URLs in image_utils.py by checking whether a supplied URL starts with an expected YouTube prefix rather than parsing and validating the actual hostname. An attacker can abuse URL userinfo syntax, such as placing an allowed-looking YouTube domain before an @ character, so the string passes the prefix check while the network request or user navigation resolves to an attacker-controlled domain. The primary technical risks are URL validation bypass, redirection to untrusted infrastructure, phishing, malware delivery, and possible exposure of data if applications fetch, display, or forward content from the attacker-controlled URL.

Why it matters to the business

Applications or workflows that accept externally supplied media URLs through affected Transformers versions may trust malicious links that appear to be YouTube links. This can lead to users or automated systems being sent to attacker-controlled sites, creating risk of credential theft, malware exposure, brand abuse, and unintended data disclosure. The CVSS score and EPSS probability are low, it is not listed in CISA KEV, and no public exploit maturity is reported, but the library is widely used in AI and ML pipelines, so organizations should still remediate during normal dependency update cycles, especially where user-supplied URLs are processed.

How an attack unfolds

An attacker identifies an application, notebook, ML pipeline, or service that uses a vulnerable Transformers version and accepts or processes external image or video-related URLs. The attacker crafts a URL that begins with an allowed YouTube-looking prefix but includes username-injection syntax using @ so that the actual destination host is controlled by the attacker. Because the vulnerable code relies on startswith() rather than robust URL parsing and hostname verification, the URL can pass validation. When the application or user follows, fetches, renders, logs, or shares the URL, traffic is directed to the malicious domain. The attacker can then serve phishing pages, malicious payloads, tracking content, or content designed to capture tokens, session data, or other sensitive information exposed by the consuming workflow.

How to fix it

Upgrade Hugging Face Transformers to a fixed release. The issue is fixed in version 4.52.1 and in the upstream Git commit 4dda5f71b35fb70cf602187eef84bb17a50b9082. If immediate upgrade is not possible, add compensating validation at application boundaries: parse URLs with a standards-compliant URL parser, reject URLs containing userinfo where it is not explicitly required, compare the normalized hostname against an allowlist, require HTTPS where appropriate, block redirects to untrusted hosts, and avoid relying on string prefix checks for trust decisions. Also restrict outbound network access from ML services where feasible so they can only reach approved domains.

How to confirm the fix worked

Confirm all deployed environments, containers, notebooks, dependency lockfiles, and build artifacts use Transformers 4.52.1 or later, or include the upstream fix commit 4dda5f71b35fb70cf602187eef84bb17a50b9082. Validate with package inspection commands such as pip show transformers, pip freeze, poetry show transformers, conda list transformers, or software composition analysis tooling. Test the application with a crafted URL containing a trusted-looking YouTube prefix followed by @ and an untrusted hostname; the fixed or mitigated implementation should reject it or treat the actual hostname as untrusted. Review the effective code path to ensure validation uses parsed hostname comparison rather than startswith().

Typical attack path

1. Find an application, ML workflow, chatbot, notebook, or API that uses Hugging Face Transformers up to version 4.49.0 and accepts externally supplied URLs.
2. Submit a crafted URL that appears to start with a trusted YouTube domain but uses URL userinfo syntax with an @ character to redirect resolution to an attacker-controlled host.
3. Rely on the vulnerable startswith()-based validation in image_utils.py to incorrectly accept the URL as trusted.
4. Trigger the application, user, or automated pipeline to fetch, render, display, or forward the malicious URL.
5. Use the attacker-controlled destination for phishing, malware delivery, tracking, or collection of sensitive data sent by the consuming workflow.

How to detect it

To determine whether this was already exploited, review application logs, API request logs, web server logs, proxy logs, DNS logs, notebook execution history, and ML pipeline job logs for user-supplied URLs that contain a YouTube-looking domain before an @ character and resolve to a non-YouTube host. Focus on requests that were accepted by URL validation and then followed by outbound connections to unusual domains or newly observed infrastructure. Look for spikes in failed or unusual media fetches, redirects to unfamiliar hosts, downloads initiated after URL submission, or users reporting credential prompts after following supposedly trusted video links. In forensic review, correlate crafted URL submissions with outbound HTTP/S requests, DNS resolutions, downloaded files, browser navigation, and authentication events. There are no reports of known KEV exploitation or named threat actor activity for this vulnerability in the provided data, so detection should focus on behavioral evidence of URL userinfo abuse rather than actor-specific tooling.

• https://www.youtube.com@
• http://www.youtube.com@
• https://youtube.com@
• http://youtube.com@
• https://youtu.be@
• http://youtu.be@
• youtube.com@
• www.youtube.com@
• youtu.be@
• image_utils.py
• startswith(

What your security team should do

• Inventory applications, containers, notebooks, and ML pipelines using Hugging Face Transformers and identify versions up to 4.49.0.
• Prioritize upgrading to Transformers 4.52.1 or later, especially for internet-facing services or workflows that process user-supplied URLs.
• Search dependency lockfiles and container images for vulnerable Transformers versions and rebuild affected artifacts after updating.
• Add centralized URL validation controls that parse and verify the hostname, reject unexpected userinfo, and enforce domain allowlists for external media retrieval.
• Review proxy, DNS, and application logs for crafted URLs containing YouTube-looking domains followed by @ and requests to unexpected external hosts.
• Restrict outbound egress from ML workloads to approved destinations where operationally feasible.
• Educate developers not to use string prefix checks such as startswith() for URL trust decisions.